OWASP Top 10 2025 vs 2021

notes

component	purpose
threat	potential source of attack or harm
vuln	weakness that can be targeted
exploit	technique used to abuse a vuln
risk	probability and impact of a successful exploit

~~what makes "broken access control" different from "authentication failure"?~~ - auth fails happen because of broken access controls

major uptick in supply chain attacks as the main application gets secured while the software it depends on is often overlooked or the risk is accepted. could also attribute this to AI apps and their underlying models
- top concern for application owners
~~SSRF is no longer on there because as applications have gotten more complicated, they solve for these easily-fixed problems first~~ - nvm, this is still a problem
nothing specific to AI because AI apps have the same vulnerabilities as software apps
a lot of these can be solved by involving security in the design process
zero-trust compensates for failure to maintain trust boundaries ✅
things that are hard to test for: logging & alerting, worst-case scenarios, insecure user behavior, supply chain failures
things that are easy to test for: insecure design, injection, broken access control
design for the worst case scenario
situation, task, action, result (STAR)

Broken access control (=, SSRF rolled in to this)
Security misconfiguration (+3)
Software supply chain failures (NEW)
Cryptographic failures (-2)
Injection (-2)
Insecure design (-2)
Authentication failure (=, but used to be Identification and authentication failures)
Software and data integrity failures (=)
Security logging and alerting failures (=, but used to be monitoring failures)
Mishandling of exceptional conditions (NEW)